LeakyX, a vulnerability that Apple and Microsoft have known about for years

Re:LeakyX, a vulnerability that Apple and Microsoft have kno... by willstrafach on Saturday September 23, 2017 @08:31PM (#15322567)

> To be clear, the issue in "Test A" is the lack of certificate validation. It wasn't immediately clear (poorly worded, IMO) but that's the (only) issue I see in that scenario and that is, indeed, a security issue (allows a MITM attack).

Actually, even this is completely wrong. You are understandably giving a charitable reading to the poorly worded explanation. I have tested this earlier today on an iOS 10.3.3 device and an iOS 11 device, and the TLS certificate is absolutely validated properly.

As you've stated with Test B, yes, if SSL is turned off then the information is indeed sent in plaintext during the account setup. However, I don't know what the purpose of this test was, as this is (as you said) expected behavior.

[ Parent | on HN ]

Re:LeakyX, a vulnerability that Apple and Microsoft have kno... by ktta on Saturday September 23, 2017 @09:25PM (#15322740)

The TLS is validated properly, but the credentials are sent even before (or right when?) the dialog shows up about the certificate error.

To be clear, here is what I did.

1. Settings->Add new account-> Exchange

2. Entered email ID (with @leakyx.com domain) and password and selected 'Next' (iOS 11 required hitting Next, and entering password on the next screen. iOS 9.3.5 has only one prompt for both email and password)

At this point, a dialog showed up about the cerficate not being valid. You have the option to continue and trust the certificate or hit 'cancel'

3. I hit cancel. (Which means, you don't trust the certificate)

The credentials still showed up. I did it twice to be sure.

On leakyx.com, [email protected] is with iOS 9.3.5 and [email protected] is with iOS 11

[ Parent | on HN ]